Network Working Group H. Ohta
Request for Comments: 2994 M. Matsui
Category: Informational Mitsubishi Electric Corporation
November 2000
A Description of the MISTY1 Encryption Algorithm
Status of this Memo
This memo provides information for the Internet community. It does
not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2000). All Rights Reserved.
Abstract
This document describes a secret-key cryptosystem MISTY1, which is
block cipher with a 128-bit key, a 64-bit block and a variable number
of rounds. It documents the algorithm description including key
scheduling part and data randomizing part.
1. Introduction
This document describes a secret-key cryptosystem MISTY1, which is
block cipher with a 128-bit key, a 64-bit block and a variable number
of rounds. It is designed on the basis of the theory of provable
security against differential and linear cryptanalysis, and moreover
it realizes high-speed encryption on hardware platforms as well as on
software environments. As the result of weighing strength and speed,
8-rounds of MISTY1 is recommended and used in most cases.
Our implementation shows that MISTY1 with eight rounds can encrypt a
data stream in CBC mode at a speed of 57Mbps and 40Mbps on Pentium
II/266MHz and PA-7200/120MHz, respectively. For its hardware
performance, we have produced a prototype LSI by a process of 0.8-
micron CMOS gate-array and confirmed a speed of 512Mbps.
2. Algorithm Description
Algorithm [1] could be divided into two parts, namely "key scheduling
part" and "data randomizing part". Key scheduling part takes a 128-
bit input key and produces a 128-bit expanded key. Data randomizing
Ohta & Matsui Informational [Page 1]

RFC 2994 MISTY1 November 2000
part takes a 64-bit input data and mixes it, namely encryption. If
data randomizing part is processed in reverse order, mixed data is
transformed to input data, namely decryption.
2.1 Terminology
Some operators are used in this document to describe the algorithm.
The operator `+' indicates two's complement addition. The operator
`*' indicates multiplication. The operator `/' yields the quotient,
and the operator `%' yields the remainder from the division. The
operator `&' indicates bitwise AND operation. The operator `|'
indicates bitwise inclusive OR operation. The operator `^' indicates
bitwise exclusive OR operation. The operator `<<' indicates bitwise
left shift operation. The operator `>>' indicates bitwise right
shift operation.
2.2 Key Scheduling Part
Key scheduling part consists of the following operations.
for i = 0, ..., 7 do
EK[i] = K[i*2]*256 + K[i*2+1];
for i = 0, ..., 7 do
begin
EK[i+ 8] = FI(EK[i], EK[(i+1)%8]);
EK[i+16] = EK[i+8] & 0x1ff;
EK[i+24] = EK[i+8] >> 9;
end
K is an input key, and each element of K, namely K[i], holds an 8-bit
of the key, respectively. EK denotes an expanded key, and each
element of EK, namely EK[i], holds a 16-bit of the expanded key.
Input data of K[0], ..., K[15] are copied to EK[0], ..., EK[7].
Expanded key is produced from EK[0], ..., EK[7] by using function FI,
and stored in EK[8], ..., EK[15]. Function FI is described in the
following section.
2.3 Data Randomizing Part
Data randomizing part uses two kinds of function, which are called
function FO and function FL. Function FO calls another function,
namely FI. The key expansion part also uses function FI. Function
FI uses two S-boxes, namely S7, S9. Each function is described as
follows.
Function FO takes two parameters. One is a 32-bit width input data,
namely FO_IN. The other is an index of EK, namely k. And FO returns
a 32-bit width data, namely FO_OUT.
Ohta & Matsui Informational [Page 2]

RFC 2994 MISTY1 November 2000
D0 = D0 ^ FO(D1, 3);
D1 = D1 ^ FO(D0, 2);
D0 = FLINV(D0, 2);
D1 = FLINV(D1, 3);
D0 = D0 ^ FO(D1, 1);
D1 = D1 ^ FO(D0, 0);
D0 = FLINV(D0, 0);
D1 = FLINV(D1, 1);
P = (D0<<32) | D1;
3. Object Identifier
The Object Identifier for MISTY1 in Cipher Block Chaining (CBC) mode
is as follows:
MISTY1-CBC OBJECT IDENTIFIER ::=
{iso(1) member-body(2) jisc(392)
mitsubishi-electric-corporation(200011) isl(61) security(1)
algorithm(1) symmetric-encryption-algorithm(1) misty1-cbc(1)}
MISTY1-CBC needs Initialization Vector (IV) as like as other
algorithms, such as DES-CBC, DES-EDE3-CBC and so on. To determine
the value of IV, MISTY1-CBC takes parameter as:
MISTY1-CBC Parameter ::= IV
where IV ::= OCTET STRING -- 8 octets.
When this Object Identifier is used, plaintext is padded before
encrypt it. At least 1 padding octet is appended at the end of the
plaintext to make the length of the plaintext to the multiple of 8
octets. The value of these octets is as same as the number of
appended octets. (e.g., If 5 octets are needed to pad, the value is
0x05.)
4. Security Considerations
The algorithm, which is described in this document, is designed in
consideration of the theory of provable security against differential
cryptanalysis and linear cryptanalysis [2][3][4]. According to the
recent result, when the algorithm consists of 8 rounds, both
differential characteristic probability and liner characteristic
probability are 2^-140. For reference, probabilities of DES are 2^-
62 and 2^-46, respectively.
Ohta & Matsui Informational [Page 7]

RFC 2994 MISTY1 November 2000
Full Copyright Statement
Copyright (C) The Internet Society (2000). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
Ohta & Matsui Informational [Page 10]